Convert YAML to JSON without uploading the file
YAML and JSON convert both ways locally. The YAML people convert is almost always infrastructure or pipeline configuration, which is the category of file most likely to have a live secret sitting in it.
At a glance
- Tool
- /tools/yaml-json-converter
- Also available
- /tools/toml-json-converter for TOML configuration
- Direction
- Both ways
- Usual source
- Deployment, pipeline or application configuration
- What such files carry
- Internal hostnames, account identifiers, and sometimes keys
- Lost in conversion
- Comments, in both directions
In detail
Converting configuration is a debugging move: one tool wants JSON and the repository holds YAML. The file being converted names internal hosts, bucket names, account identifiers and, more often than anyone admits in public, a password or an access key sitting in plain text three levels deep. Pasting it into a hosted converter is an infrastructure disclosure, and no redaction habit is as reliable as the file simply not going anywhere.
Comments do not survive, in either direction, because JSON has nowhere to put them. That matters more than it sounds: the comments in a config file carry the reasoning, including the line explaining why a limit is set low and must not be raised. Keep the YAML as the source of truth and treat any JSON you produce as output, never as something you edit and convert back.
Anchors and aliases expand when they are converted, so a compact YAML file with one shared block referenced in five places becomes a JSON file with five copies of that block. That is correct behaviour rather than a bug, but it makes the output longer than expected and it means editing one copy no longer edits the others.
Confirm the local claim by disconnecting the network and converting a real config file. It completes. That is also the moment to check whether the file you just handled has a credential in it, because if it has ever been pasted into anything hosted, the credential needs rotating regardless of who you think saw it.
Things that catch people out
- Comments are lost both ways. Never adopt a workflow of converting to JSON, editing, and converting back.
- Unquoted values such as yes, no, on and off can be read as booleans rather than text depending on the parser. Quote anything that is meant to be a word.
- If the file contained a credential and has been through any hosted tool or chat, rotate it. Deleting the message is not a remedy.
Try it: Hash Generator
The file hasher is on every page here because it takes any file at all and proves the point: disconnect from the network, drop a file in, and it still returns a checksum you can compare against a published one.
Hash Generator
LOCAL · Browser-OnlyGenerate MD5, SHA-1, SHA-256, SHA-384, SHA-512, SHA3-256, SHA3-512, Keccak-256, CRC32, and HMAC hashes from text or files
MD5 is cryptographically broken and should not be used for security purposes. Use SHA-256 or SHA-512 instead.
Related Working without uploading
All working without uploading →Check a .env file without uploading your secrets
Find duplicate keys, mask values and generate a .env.example locally. A .env is nothing but credentials, so uploading one means rotating them.
Format and validate JSON without uploading it
Tidy and check JSON in your browser. The JSON people paste into a formatter is usually a live API response full of real records.
Convert XML to JSON without uploading the document
Convert XML in your browser. Why attributes, namespaces and repeated elements have no single correct JSON equivalent to fall back on.
Compare two files without uploading either of them
Diff two versions of a document or a config in your browser. A hosted comparison receives both files, which doubles the exposure.
View a file as a hex dump without uploading it
Inspect any file's raw bytes in your browser. If you cannot identify a file, uploading it to find out is the wrong first move.
Minify JavaScript without uploading your source
Minify scripts and stylesheets in your browser. Source carries comments, endpoints and internal names, and minifying is not obfuscation.
Tools for this
- YAML ↔ JSON Converter Free online YAML ↔ JSON converter - convert between YAML and JSON formats with validation and formatting
- TOML/JSON Converter Convert between TOML and JSON online - bidirectional converter with full TOML v1.0 support
- .env Editor & Validator Edit and validate .env files online - detect duplicates, mask secrets, generate .env.example